Web Enumeration

whatweb <URL>
curl -I <URL>

# Directory fuzzing
ffuf -u http://<IP>/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-directories.txt -mc 200,301,302,403 -t 50

# File fuzzing
ffuf -u http://<IP>/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-files.txt -e .php,.txt,.html,.bak

# vHost fuzzing
ffuf -u http://<IP>/ -H "Host: FUZZ.<domain>" -w subs.txt -mc 200 -fs <size>

# POST body fuzzing
ffuf -u http://<IP>/login -X POST -d "username=FUZZ&password=test" -w users.txt -mc 200

# Parameter fuzzing
ffuf -u http://<IP>/page?FUZZ=test -w /usr/share/wordlists/seclists/Discovery/Web-Content/burp-parameter-names.txt -mc 200 -fs <size>

# Basic: depth 2, min word length 5, save to file
cewl http://$TARGET:$PORT/ -d 2 -m 5 -w cewl_out.txt

# Include numbers in the wordlist
cewl http://$TARGET/ -d 2 -m 5 --with-numbers -w cewl_out.txt

# Extract emails too
cewl http://$TARGET/ -d 2 -m 5 -e -w cewl_out.txt

# With HTTP basic auth
cewl http://$TARGET/ -d 2 -m 5 \
  --auth-type basic --auth-user $USER --auth-pass $PASSWORD \
  -w cewl_out.txt

# With a session cookie (post-login pages)
cewl http://$TARGET/ -d 3 -m 4 \
  -H "Cookie: PHPSESSID=$SESSION_ID" \
  -w cewl_out.txt

# Include words from meta tags (-a) and verbose count
cewl http://$TARGET/ -d 2 -m 5 -a -v -w cewl_out.txt

cat /usr/share/wordlists/rockyou.txt cewl_out.txt | sort -u > combined.txt

gobuster dir -u http://<IP> -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-directories.txt -x php,html,txt -t 50

feroxbuster -u http://<IP> -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-directories.txt -x php,html -t 50 --depth 3